Each one is a service that passes its tests and still fails in production. Pick one.
After a bad afternoon, every request waits for a database connection. The visible tests pass. Work out what production does that the tests do not.
A refused or failed order gives its database connection back.
Orders keep going through after any number of refusals.
A refused order leaves nothing behind in the database, including for the next order that uses the same connection.
The customer still hears that their order was refused.
Every connection is given back exactly once.